Bug 6176 - Null pointer dereference on OOM in _cairo_output_stream_create_for_file()
Summary: Null pointer dereference on OOM in _cairo_output_stream_create_for_file()
Alias: None
Product: cairo
Classification: Unclassified
Component: general (show other bugs)
Version: 1.1.1
Hardware: All All
: high normal
Assignee: Carl Worth
QA Contact: cairo-bugs mailing list
URL: http://gitweb.freedesktop.org/?p=cair...
Depends on:
Reported: 2006-03-08 11:55 UTC by Ken Herron
Modified: 2006-03-13 12:10 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Description Ken Herron 2006-03-08 11:55:53 UTC
This was found through a coverity scan of the mozilla source; see

See |_cairo_output_stream_create_for_file| in cairo-output-stream.c. If
|_cairo_output_stream_create| returns NULL, it's dereferenced following the
|fclose| call.
Comment 1 Carl Worth 2006-03-14 07:10:18 UTC
This is now fixed in cairo 1.1.1 and 1.0.3.


diff-tree c780f4a5624f27a6cbf7829e10e8cd3544ae4f38 (from
Author: Carl Worth <cworth@cworth.org>
Date:   Mon Mar 13 12:05:13 2006 -0800

    cairo-output-stream: Don't dereference a NULL pointer due to OOM.

    This close bug #6176:

        Null pointer dereference on OOM in _cairo_output_stream_create_for_file()

diff --git a/src/cairo-output-stream.c b/src/cairo-output-stream.c
index a6db091..b07423c 100644
--- a/src/cairo-output-stream.c
+++ b/src/cairo-output-stream.c
@@ -305,9 +305,11 @@ _cairo_output_stream_create_for_file (co
        return NULL;

     stream = _cairo_output_stream_create (stdio_write, fp);
-    if (stream == NULL)
+    if (stream)
+       stream->owns_closure_is_file = TRUE;
+    else
        fclose (fp);
-    stream->owns_closure_is_file = TRUE;

     return stream;

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.